SCPms, SCC and SAP HANA 2.0 integration with SSO not working

we are developing an Hybrid application on SAP Cloud Platform mobile services that consume an oData Service on SAP HANA 2.0 (on premise). The service is exposed by XSA (mta project). The two systems are connected by SAP Cloud Connector.

The application show a list that have to be filtered for users. We have created the destination on SCPms that use the virtual host on SCC with the principal propagation flag checked. In the monitor on SCC, we can see, in the service url called by SCPms, our user propagated to SAP HANA.

This scenario is not working using SSO between SCPms and SAP HANA, based on X509 Certificates. All certificates are uploaded on SCC and SAP HANA.

Is this scenario correct and feasible? If yes, is there a SAP guide to properly configure it? Because we have develop the oData service using the XSUAA service and called via browser, correctly it redirects us (with app router), after authentication, to the xsodata service. When we call the same service, throw the SCPms destination, we receive the Timeout error while calling XSUAA service.